summaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
authorBenoît Ganne <bganne@cisco.com>2024-03-06 19:02:18 +0100
committerNeale Ranns <neale@graphiant.com>2024-04-09 04:49:17 +0000
commit7b899be710263dd334112f18db0f055625d9da5a (patch)
treec8386ac880c40e4bad757537698d5c310d70f6c9
parent302db471a01b5c21b80e9bc769315cef4da0ed80 (diff)
fib: fix off-by-one error in rewrite length check
The rewrite string can be up to max_size, and max_size can be up to VNET_REWRITE_TOTAL_BYTES. Don't waste the last byte. Type: fix Change-Id: I2fb7e9873b6b4c1e6a55b172c7f753f3c5910802 Signed-off-by: Benoît Ganne <bganne@cisco.com>
-rw-r--r--src/vnet/adj/rewrite.h4
1 files changed, 2 insertions, 2 deletions
diff --git a/src/vnet/adj/rewrite.h b/src/vnet/adj/rewrite.h
index 5cb90e47318..06b1b00882e 100644
--- a/src/vnet/adj/rewrite.h
+++ b/src/vnet/adj/rewrite.h
@@ -147,8 +147,8 @@ vnet_rewrite_set_data_internal (vnet_rewrite_header_t * rw,
int max_size, void *data, int data_bytes)
{
/* Sanity check values carefully for this clib_memset operation */
- ASSERT ((max_size > 0) && (max_size < VNET_REWRITE_TOTAL_BYTES));
- ASSERT ((data_bytes >= 0) && (data_bytes < max_size));
+ ASSERT ((max_size > 0) && (max_size <= VNET_REWRITE_TOTAL_BYTES));
+ ASSERT ((data_bytes >= 0) && (data_bytes <= max_size));
rw->data_bytes = data_bytes;
clib_memcpy_fast (rw->data, data, data_bytes);